Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Impossible IP packet: SIG 1102 (0) - ( address)

I have just noticed that this signature has fired for 2 of our different clients but with the same source/ destination IP's. I would normally assume that this is either impossible or very strange.

I think that might be where the name of the signature comes from anyway?

In each case all IP addresses reported, were

Is this a generic address that simply represents an internal unknown device?

Does the signature need tweaking on the sensor? How are we meant to advise the client of where this activity comes from?

And finally, does it require a TAC case to request an update from Cisco?

It slightly concerns me that this signature has an impact rating of high, and we've not noticed this before, and every instance has been ignored (not filtered, etc).

The nature of this signature is an attempt to crash the device by having an IP packet with equal S & D. It is known as the Land attack, but does it matter what the IP's actually are?

If it can never occur within legitimate traffic, then can we always ignore.

Any help would be appreciated.



Re: Impossible IP packet: SIG 1102 (0) - ( address)

Google that address and you'll get some potential clues.

New Member

Re: Impossible IP packet: SIG 1102 (0) - ( address)

I have tried google and it doesn't really give any more clues other than it can be converted into binary. Or it is a different numerical representation of the same thing (eg. hex, octal, or decimal).

I would like an official opinion from Cisco, in terms of the actual signature. If it always fires with this IP, and we can never advise the client of it's true source, then what is the point in monitoring it, via an IPS sensor?



Re: Impossible IP packet: SIG 1102 (0) - ( address)

This isn't a Cisco issue or limitation. Any network IDS is going to have limited ability to tell you the true source of a spoofed (or corrupt) packet. That doesn't mean it isn't useful to know when something like this is occuring. You should get a trace (turn on action=log pair packets) and take a look at the source MAC address to find out where it's coming from. If it's coming from a router, keep working backward until you get to the source.

CreatePlease to create content